Topic starter
24/06/2026 10:32 pm
TL;DR: Identity security is being pulled toward business continuity, compliance and digital transformation as cloud adoption, third-party risk and autonomous agents expand the access surface, according to SailPoint and KPMG. The governance problem is no longer just access management, but whether organisations can prove the right access exists at the right time across people, vendors and AI-driven actors.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “A conversation with KPMG: Identity security, AI governance & third-party risk”.
By the numbers:
- 60% of breaches being identity-based
Key questions
Q: What breaks when third-party access is not lifecycle managed?
A: Access outlives accountability.
Q: Why do autonomous agents change identity governance more than chatbots do?
A: Because the risk moves from generated content to real access.
A: Yes. Organisations should start with a governance layer that gives them visibility into identities, entitlements, and application access, then extend privileged controls where the highest risk exists. That sequence helps teams establish policy, approvals, and review discipline before they manage elevated access at scale. It also makes later PAM expansion easier to operationalise.
Practitioner guidance
- Audit third-party access lifecycles Inventory vendor, partner and outsourced accounts across connected platforms, then tie each one to an owner, business purpose and offboarding trigger.
- Separate AI agent access from human access Create a distinct governance path for autonomous agents so their entitlements, approvals and logging are not forced into human access review cadences.
- Rework access reviews for hybrid environments Focus recertification on active business relationships, system touchpoints and stale delegated access, not on identity lists alone.
Bottom line: Identity governance is being pulled into continuity, compliance and transformation decisions as external access and AI-driven actors expand the control surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:15 am
Identity governance is becoming the control plane for enterprise resilience. The article shows that identity has moved from a permissions topic to a business continuity topic because cloud integration and external access now shape operational continuity. That is a material shift for governance models built around periodic access review alone. The practitioner conclusion is that identity programmes must be evaluated by how well they preserve service continuity under change, not just by how many reviews they complete.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between runtime authorization and access reviews for agents?
A: Access reviews look backward at entitlements already granted, while runtime authorization controls the action before it happens. For AI agents, that distinction matters because the risky decision often occurs after access is approved, when the agent selects a tool or data source that changes the scope of the session.
👉 Read our full editorial: Identity security, AI governance and third-party risk are converging